tailieunhanh - Bảo mật cho joomla part 13

Dưới đây là danh sách những thứ bạn sẽ muốn biết: • • • • • • • • • • • tên máy chủ là gì? Họ ở đâu tổ chức (những gì web host)? Hệ điều hành họ có? trang web của họ được xây dựng trên (Joomla!, Mambo, Drupal, HTML, và do đó trên) là gì? địa chỉ IP của họ, máy chủ tên, và như vậy là gì? " | This material is copyright and is licensed for the sole use by Thomas Rosenblum on 4th December 2008 1010 SW High Ave. Topeka 66604 Chapter 6 Here is a list of things you will want to know What is the host name Where are they hosted what web host Which operating system do they have What is their website built on Joomla Mambo Drupal HTML and so on What are their IP address name servers and so on What is the network IP range of their site important Which physical machines are active if applicable Which ports are open which are filtered and which are closed What services are running What are the version levels of all their software or the vulnerable extension Do you have a map of their network as in the case of corporate attacks There are several other pieces of information that could be important but these are all usually obtained very legally and thus you may risk opening yourself up. It doesn t mean that you need to give out or allow access to this information where you can stop it from happening. Answers to these questions would give you information that you need for the first phase of the attack and allow you to gather steam for the next portion of the attack. Rootkit and command shells One of the most popular things to do is to break in and place a rootkit or command shell onto the server. When I was writing this chapter I found an attempted attack in my logs. I pointed my browser to the site that it came from and found that it had lost its file it was not a Joomla site and the directory was laid bare. After viewing the directory I noted a file called the command shell. Executing this gave the bad guys complete access to this poor guy s server. I told the hosting company s administrator where to find it and clean it up. This type of information is published in the underground as soon as a site is cracked and all kiddie-scripters attempt to launch attacks against your site with it. This type of work is also known as footprinting the site. A .